Proofpoint_url_defense Not Decoding correctly

That doesn’t look right. I think the input to the plugin is wrong somehow. My guess is this needs stripped off “;!!MiZrGOEI0vA!NohzERuuhFAIty3SEYDFKwxCVMolJEd8Nz9rLcG4K7F8vlC_LdVlbApnP4DYHhi0l4wPQz_sD0PvfecXmeU0yUsS$”

leaving

https://urldefense.com/v3/__https://www.myclientline.net/publicS/publicServ/ClientLineEnrollment/complete.jsp__

Can you split on ( ; ) and take the first element maybe?